<?php
// Root-only API: search accounts by username or domain substring.
// GET param: q (search query)
// Returns JSON: { "results": [ { username, domains, site_count, disabled_reason, disabled_at, disabled_by }, ... ] }

require_once('/docker/whp/web/libs/permission_checker.php');
require_once('/docker/whp/web/libs/account_disable.php');

header('Content-Type: application/json');

if (!is_root_user()) {
    http_response_code(403);
    echo '{}';
    return;
}

$q = trim((string)($_GET['q'] ?? ''));
if ($q === '') {
    echo json_encode(['results' => []]);
    return;
}

echo json_encode(['results' => search_accounts($q)]);
